37f7f62157
Seven security issues from an audit, plus album pages and the map coming up empty against Immich 3.x. Verified against a real Immich 3.0.3 instance in a production build. Security: - Admin session forgery via a hardcoded 'dev-fallback-secret' signing key that bypassed the production AUTH_SECRET guard - /api/map ignored album passwords and returned working asset tokens; rewriting ?size=thumbnail to ?size=original downloaded full-resolution originals from protected albums - Admin login had no rate limit, and the client IP came from a spoofable header, so rotating it bypassed every limit in the app - Raw Immich asset UUIDs were serialized into the RSC payload - Album tokens never expired server-side; a captured token replayed forever - Path traversal into the Immich API via an unvalidated album id - /admin ran with no enforced CSP (only Report-Only reached it) TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable matched proxy IPs against the socket peer address, which self-hosted Next.js never exposes, so the check could never pass: unset, the limiter read a spoofable header; set, every request shared one bucket and a single client could rate-limit the whole site. Migrates automatically. Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from POST /search/metadata with withExif: true — without that flag EXIF is omitted and grid aspect ratios, the lightbox panel and map markers stay empty. Drops support for Immich below 3.0, which now logs a warning. Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1); visitors of protected areas and admin sessions must log in once more. 91 unit tests (25 new); the new admin-auth and rate-limit cases were confirmed to fail against the pre-fix code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
81 lines
2.2 KiB
TypeScript
81 lines
2.2 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import {
|
|
verifyAdminPassword,
|
|
createAdminToken,
|
|
isAdminAuthenticated,
|
|
isAdminEnabled,
|
|
COOKIE_NAME,
|
|
SESSION_DURATION_MS,
|
|
} from '@/lib/admin/auth';
|
|
import { checkRateLimit, getClientIp } from '@/lib/rate-limit';
|
|
|
|
/** Admin login attempts per minute per IP — the highest-value credential in the app. */
|
|
const ADMIN_AUTH_RPM = 5;
|
|
|
|
/** POST: Login with admin password. */
|
|
export async function POST(request: NextRequest) {
|
|
const ip = getClientIp(request);
|
|
const rl = checkRateLimit(`admin-auth:${ip}`, ADMIN_AUTH_RPM);
|
|
if (!rl.success) {
|
|
return NextResponse.json(
|
|
{ error: 'Too many requests' },
|
|
{
|
|
status: 429,
|
|
headers: { 'Retry-After': String(Math.ceil((rl.resetAt - Date.now()) / 1000)) },
|
|
},
|
|
);
|
|
}
|
|
|
|
if (!isAdminEnabled()) {
|
|
return NextResponse.json(
|
|
{ error: 'Admin panel is not enabled. Set ADMIN_PASSWORD in your environment.' },
|
|
{ status: 403 },
|
|
);
|
|
}
|
|
|
|
const body = await request.json().catch(() => null);
|
|
if (!body?.password || typeof body.password !== 'string') {
|
|
return NextResponse.json({ error: 'Password is required' }, { status: 400 });
|
|
}
|
|
|
|
if (!verifyAdminPassword(body.password)) {
|
|
return NextResponse.json({ error: 'Invalid password' }, { status: 401 });
|
|
}
|
|
|
|
const token = createAdminToken();
|
|
const response = NextResponse.json({ success: true });
|
|
|
|
response.cookies.set(COOKIE_NAME, token, {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
path: '/',
|
|
maxAge: SESSION_DURATION_MS / 1000,
|
|
});
|
|
|
|
return response;
|
|
}
|
|
|
|
/** GET: Check session status. */
|
|
export async function GET() {
|
|
if (!isAdminEnabled()) {
|
|
return NextResponse.json({ authenticated: false, enabled: false });
|
|
}
|
|
|
|
const authenticated = await isAdminAuthenticated();
|
|
return NextResponse.json({ authenticated, enabled: true });
|
|
}
|
|
|
|
/** DELETE: Logout. */
|
|
export async function DELETE() {
|
|
const response = NextResponse.json({ success: true });
|
|
response.cookies.set(COOKIE_NAME, '', {
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === 'production',
|
|
sameSite: 'strict',
|
|
path: '/',
|
|
maxAge: 0,
|
|
});
|
|
return response;
|
|
}
|